feat(recovery): model vanished runner job recovery

[rldyourmnd]

Implements the autonomous recovery engine for #201.

The branch now includes:

• strict typed policy and crash-reconstructable decision state;
• fsync-backed compare-and-swap transaction store;
• exact GitHub force-cancel and full-run rerun client;
• gha-vanished-job-recovery plan/apply CLI;
• bounded command observation for autonomous batch reconciliation;
• per-repository bounded token-command resolution;
• gha-garm-app-token, which mints short-lived installation tokens from an existing encrypted GARM GitHub App envelope without persisting private keys or tokens;
• duplicate-observation rejection and bounded durable history;
• unit and race coverage for policy, state, store, controller, GitHub API, observer and credential minting.

An incremented authoritative run_attempt suppresses duplicate reruns after a process crash, while completed records suppress replay within bounded history. Private runtime wiring is staged in NDDev-it-com/github-device-sync-estate#265; its live read-only qualification minted tokens and read organization runners for all three installed Apps without printing secrets.

Verification: make verify (vet, full race suite, trimpath build).

[rldyourmnd]

Retriggering the exact verified head after GitHub Actions began recovering from the major outage; no code or commit identity changed.

[rldyourmnd]

Retriggering the exact fully verified head after GitHub Actions resumed accepting traffic. Workflow-dispatch run 32989549278 passed Test, Race, Static/build, both reproducible derivatives and Gate on this exact commit.

[rldyourmnd]

Retriggering the exact current head after obsolete delayed runs from pre-rebase commits terminalized. Exact-head workflow-dispatch Gate 32989549278 is green.